instead of in an encrypted format on its internal systems.
Riiight, like that’s any better. Jokes aside, it’s hard to imagine what kind of “mistake” results in storing plain text instead of hashing, unless the mistake was in choosing whoever made the security assessment
There was a previous article on this with more explanation that I’m struggling to find.
The gist was that they do hash all passwords stored, the problem was that there was a mistake made with the internal tool they use to do that hashing which led to the passwords inadvertently going into some log system.
Riiight, like that’s any better. Jokes aside, it’s hard to imagine what kind of “mistake” results in storing plain text instead of hashing, unless the mistake was in choosing whoever made the security assessment
There was a previous article on this with more explanation that I’m struggling to find.
The gist was that they do hash all passwords stored, the problem was that there was a mistake made with the internal tool they use to do that hashing which led to the passwords inadvertently going into some log system.
Makes sense now, thank you
“mistake”
I call BS. The reviews I’ve gone through for trivial stuff would’ve exposed this.
This was intentional.
Hanlon’s Razor revised: Never attribute to malice what can be attributed to incompetence, except where there is an established pattern of malice.
Yeah, cause trivial systems are a lot easier to parse and review. At a base level that’s nonsense logic.
My point being the extensiveness of a review process.
The more important a system, the more people it impacts, etc, the more extensive the review process.
Someone chose to ignore this risk. That’s intentional.
Never assume malice when something can be explained by stupidity
Christ, the hell I would’ve gotten, in the 90’s, if I’d done something like this.